CVE-2024-43813CWE-284

IDOR when marking read a user's channel

Medium · published August 22, 2024

CVSS v3.1
4.3
EPSS
0%
Percentile
14.7
In the wild
Unconfirmed
What it is

Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to enforce proper access controls which allows any authenticated user, including guests, to mark any channel inside any team as read for any user.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00244 · 14.7th percentile
Weakness
CWE-284 · Improper Access Control
Published
2024-08-22T06:30Z
EPSS history
Timeline
  • 22 AUG 06:30Z
    IDOR when marking read a user's channel
    cvelistv5